The on-premise AI assistant for Saudi data analysts.
مساعد ذكاء اصطناعي محلي بالكامل لمحلل البيانات السعودي.
Vision Platform · منصة الرؤية · Trust Center · مركز الثقة · Engineering · الهندسة
بالعربية: هذا المستودع يحوي البرنامج التشغيلي لبصيرة — تطبيق سطح مكتب أصلي يعمل بالكامل داخل بنية الجهة السعودية، يخدم محلل البيانات في مهامه اليومية بالعربية والإنجليزية. لا اتصال خارجي، لا سحابة، لا نقل للبيانات خارج الجهة — بحكم البنية، لا بحكم الوعد.
English: This repository contains the operational program for Basira — a native desktop application that runs fully inside the Saudi entity's infrastructure, serving the data analyst in their daily work in Arabic and English. No external calls, no cloud, no data transfer outside the entity — by architecture, not by promise.
Important
Status: foundation phase. This repository contains a clean
scaffold of the operational program — the Tauri 2.0 desktop shell,
the React 19 frontend, the SQLite database schema, the cryptographic
audit chain skeleton, and the Saudi PII detection engine. Core
features are being built out iteratively. See CHANGELOG.md
for the current state and docs/operations/roadmap.md
for what is next.
New: docs/strategy/master-plan.md explains the phased
path from this foundation to a real pilot deployment, and
docs/strategy/realistic-scenarios.md stress-tests
that plan against concrete scenarios. Read these before starting any milestone past M0.
For Saudi data analysts working inside a Saudi entity, the program:
- Writes SQL queries from natural language (Arabic or English) against the entity's data warehouse.
- Builds Power BI / DAX expressions for KPI dashboards.
- Cleans data — missing-value strategies, outlier detection, type coercion — with the analyst approving each transformation.
- Drafts executive reports in formal Arabic or English, bound by what the data actually says.
- Detects sensitive patterns — Saudi National IDs, IBANs, MRNs, phone numbers, vehicle plates — before any output leaves the analyst's workspace.
- Signs every operation cryptographically. Nothing the program does is unverifiable.
All inference runs on the entity's own GPU. The model weights are open-source, downloaded once at install time, and never sent anywhere. The application has no network egress capability at all — see ADR-001.
The program is designed against:
- PDPL — Personal Data Protection Law (articles 5, 6, 19, 27)
- NDMO — National Data Management framework (DMP-1: data classification)
- NCA ECC — Essential Cybersecurity Controls (ECC-2-1, ECC-2-3, ECC-2-7)
- SAMA CSF — Saudi Central Bank cybersecurity framework (financial sector deployments)
- SDAIA AI Ethics — All seven principles (Fairness, Privacy & Security, Humanity, Social & Environmental Benefits, Reliability & Safety, Transparency, Accountability)
Compliance mapping is published on the Trust Center and reproduced in docs/compliance/.
| Layer | Technology | Version | Rationale |
|---|---|---|---|
| UI shell | Tauri | 2.0 | 10× smaller than Electron, Rust-safe core. ADR-004 |
| Native core | Rust | 1.79+ | Memory-safe, no GC pauses, FFI-friendly. |
| UI framework | React + TypeScript | 19 / 5.9 | Same as the vision platform — shared design tokens. |
| Styling | Tailwind CSS | v4 | Matches platform's design system. |
| Database | SQLite + sqlite-vec | 3.45+ / 0.1+ | Single-file storage, vector search built-in. ADR-003 |
| Cryptography | Ed25519 + AES-256-GCM + SHA-256 | — | NIST FIPS 180-4 + RFC 8032 compliant. ADR-002 |
| Language model | Open-source weights | varies | Llama-family models tuned for Arabic. Runs via llama.cpp / vLLM. |
| Build tooling | pnpm + Cargo | 10.4+ / 1.79+ | Reproducible, lockfile-frozen, offline-installable. |
Every dependency is open-source. There is no commercial vendor lock-in.
You need:
- Node.js 22+ and pnpm 10+ — for the TypeScript frontend and orchestration.
- Rust 1.79+ (via rustup) — for the Tauri shell.
- Microsoft Visual Studio Build Tools (Windows) or equivalent — for Cargo to link native binaries.
- WebView2 Runtime (Windows 10/11 ships with this by default).
Run pnpm verify-env to check that all prerequisites are present.
# From the repository root (C:\dev\basira-program)
pnpm install # install all TypeScript deps
cd apps/desktop/src-tauri
cargo fetch # pre-cache Rust deps
cd ../../..
pnpm verify-env # verify Node, pnpm, Rust, WebView2 are all readypnpm tauri:dev # launches the desktop app with hot-reload on the frontend
pnpm check # tsc --noEmit across all TypeScript packages
pnpm test # run all unit tests
pnpm lint # ESLint + clippypnpm tauri:build # produces .msi and .exe under apps/desktop/src-tauri/target/release/bundle/The MSI bundle is signed at build time if BASIRA_SIGN_CERT is set in the environment; otherwise it produces an unsigned dev bundle. Production builds MUST be signed — see docs/security/code-signing.md.
basira-program/
├── apps/
│ └── desktop/ # the Tauri desktop application
│ ├── src/ # React frontend
│ ├── src-tauri/ # Rust backend (Tauri shell)
│ ├── public/ # static assets (icons, fonts)
│ ├── index.html
│ ├── package.json
│ ├── vite.config.ts
│ └── tsconfig.json
├── packages/
│ ├── pii-guard/ # Saudi PII detection — National ID / IBAN / MRN / phone / plate
│ ├── audit-chain/ # Ed25519 + SHA-256 cryptographic audit chain
│ ├── i18n/ # bilingual translations (ar / en)
│ ├── ui/ # shared React UI primitives
│ └── types/ # shared TypeScript types across the monorepo
├── docs/
│ ├── architecture/ # ADRs (Architecture Decision Records)
│ ├── security/ # security policies and procedures
│ ├── operations/ # runbooks, roadmap, deployment guides
│ └── compliance/ # PDPL / NDMO / NCA ECC / SAMA / SDAIA mappings
├── scripts/ # setup, verify-env, build orchestration
├── tests/
│ ├── e2e/ # end-to-end Playwright tests
│ └── integration/ # cross-package integration tests
├── .github/workflows/ # CI/CD pipelines
├── package.json # root workspace
├── pnpm-workspace.yaml
├── tsconfig.base.json
├── README.md # ← you are here
├── CONTRIBUTING.md
├── SECURITY.md
├── CHANGELOG.md
├── LICENSE-FSL-1.1-Apache-2.0
└── LICENSE-Apache-2.0
Author: Emad Fayez Al-Balawi · B.Sc. Computer Science · Prince Fahd bin Sultan University
AI tooling disclosure: This codebase is scaffolded and incrementally developed with Anthropic's Claude Code as a development tool, under the operator's full supervision. The language model that runs inside Basira at deployed entities is fully independent of Claude — it is an open-source model running locally on the entity's GPU, with no connection to any commercial AI vendor. This disclosure aligns with SDAIA AI Ethics § Transparency.
This program is distributed under the Functional Source License v1.1, converting to Apache 2.0 ("FSL-1.1-Apache-2.0").
In plain language:
- ✅ You may read, modify, and self-host this software for any purpose, commercial or non-commercial, as long as you do not compete with the program by offering it as a service.
- ✅ Two years after each release date, that release automatically converts to a full Apache 2.0 license — no restrictions.
- ❌ For two years after release, you may not offer this software as a competing managed service.
Full text: LICENSE-FSL-1.1-Apache-2.0 and the eventual LICENSE-Apache-2.0.
For licensing questions, deployment partnerships, or audit requests, reach out via the Contact page on the vision platform.
بصيرة — حيث البيانات تصبح بصيرة
Basira — Where Data Becomes Insight